org.argeo.util/src/org/argeo/osgi/useradmin/DirectoryUserAdmin.java

   1 package org.argeo.osgi.useradmin;
   2
   3 import static org.argeo.util.naming.LdapAttrs.objectClass;
   4 import static org.argeo.util.naming.LdapObjs.extensibleObject;
   5 import static org.argeo.util.naming.LdapObjs.inetOrgPerson;
   6 import static org.argeo.util.naming.LdapObjs.organizationalPerson;
   7 import static org.argeo.util.naming.LdapObjs.person;
   8 import static org.argeo.util.naming.LdapObjs.top;
   9
  10 import java.net.URI;
  11 import java.security.PrivilegedAction;
  12 import java.util.ArrayList;
  13 import java.util.Dictionary;
  14 import java.util.Hashtable;
  15 import java.util.Iterator;
  16 import java.util.List;
  17
  18 import javax.naming.Context;
  19 import javax.naming.InvalidNameException;
  20 import javax.naming.directory.Attributes;
  21 import javax.naming.directory.BasicAttribute;
  22 import javax.naming.directory.BasicAttributes;
  23 import javax.naming.ldap.LdapName;
  24 import javax.naming.ldap.Rdn;
  25 import javax.security.auth.Subject;
  26 import javax.security.auth.kerberos.KerberosTicket;
  27
  28 import org.argeo.util.CurrentSubject;
  29 import org.argeo.util.directory.DirectoryConf;
  30 import org.argeo.util.directory.DirectoryDigestUtils;
  31 import org.argeo.util.directory.HierarchyUnit;
  32 import org.argeo.util.directory.ldap.AbstractLdapDirectory;
  33 import org.argeo.util.directory.ldap.LdapDao;
  34 import org.argeo.util.directory.ldap.LdapEntry;
  35 import org.argeo.util.directory.ldap.LdapEntryWorkingCopy;
  36 import org.argeo.util.directory.ldap.LdapNameUtils;
  37 import org.argeo.util.directory.ldap.LdifDao;
  38 import org.osgi.framework.Filter;
  39 import org.osgi.framework.FrameworkUtil;
  40 import org.osgi.framework.InvalidSyntaxException;
  41 import org.osgi.service.useradmin.Authorization;
  42 import org.osgi.service.useradmin.Role;
  43 import org.osgi.service.useradmin.User;
  44 import org.osgi.service.useradmin.UserAdmin;
  45
  46 /** Base class for a {@link UserDirectory}. */
  47 public class DirectoryUserAdmin extends AbstractLdapDirectory implements UserAdmin, UserDirectory {
  48
  49         private UserAdmin externalRoles;
  50         // private List<String> indexedUserProperties = Arrays
  51         // .asList(new String[] { LdapAttrs.uid.name(), LdapAttrs.mail.name(),
  52         // LdapAttrs.cn.name() });
  53
  54         // Transaction
  55 //      private TransactionManager transactionManager;
  56         public DirectoryUserAdmin(URI uriArg, Dictionary<String, ?> props) {
  57                 this(uriArg, props, false);
  58         }
  59
  60         public DirectoryUserAdmin(URI uriArg, Dictionary<String, ?> props, boolean scoped) {
  61                 super(uriArg, props, scoped);
  62         }
  63
  64         public DirectoryUserAdmin(Dictionary<String, ?> props) {
  65                 this(null, props);
  66         }
  67
  68         /*
  69          * ABSTRACT METHODS
  70          */
  71
  72         protected AbstractLdapDirectory scope(User user) {
  73                 if (getDirectoryDao() instanceof LdapDao) {
  74                         return scopeLdap(user);
  75                 } else if (getDirectoryDao() instanceof LdifDao) {
  76                         return scopeLdif(user);
  77                 } else {
  78                         throw new IllegalStateException("Unsupported DAO " + getDirectoryDao().getClass());
  79                 }
  80         }
  81
  82         protected DirectoryUserAdmin scopeLdap(User user) {
  83                 Dictionary<String, Object> credentials = user.getCredentials();
  84                 String username = (String) credentials.get(SHARED_STATE_USERNAME);
  85                 if (username == null)
  86                         username = user.getName();
  87                 Dictionary<String, Object> properties = cloneConfigProperties();
  88                 properties.put(Context.SECURITY_PRINCIPAL, username.toString());
  89                 Object pwdCred = credentials.get(SHARED_STATE_PASSWORD);
  90                 byte[] pwd = (byte[]) pwdCred;
  91                 if (pwd != null) {
  92                         char[] password = DirectoryDigestUtils.bytesToChars(pwd);
  93                         properties.put(Context.SECURITY_CREDENTIALS, new String(password));
  94                 } else {
  95                         properties.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
  96                 }
  97                 DirectoryUserAdmin scopedDirectory = new DirectoryUserAdmin(null, properties, true);
  98                 scopedDirectory.init();
  99                 return scopedDirectory;
 100         }
 101
 102         protected DirectoryUserAdmin scopeLdif(User user) {
 103                 Dictionary<String, Object> credentials = user.getCredentials();
 104                 String username = (String) credentials.get(SHARED_STATE_USERNAME);
 105                 if (username == null)
 106                         username = user.getName();
 107                 Object pwdCred = credentials.get(SHARED_STATE_PASSWORD);
 108                 byte[] pwd = (byte[]) pwdCred;
 109                 if (pwd != null) {
 110                         char[] password = DirectoryDigestUtils.bytesToChars(pwd);
 111                         User directoryUser = (User) getRole(username);
 112                         if (!directoryUser.hasCredential(null, password))
 113                                 throw new IllegalStateException("Invalid credentials");
 114                 } else {
 115                         throw new IllegalStateException("Password is required");
 116                 }
 117                 Dictionary<String, Object> properties = cloneConfigProperties();
 118                 properties.put(DirectoryConf.readOnly.name(), "true");
 119                 DirectoryUserAdmin scopedUserAdmin = new DirectoryUserAdmin(null, properties, true);
 120 //              scopedUserAdmin.groups = Collections.unmodifiableNavigableMap(groups);
 121 //              scopedUserAdmin.users = Collections.unmodifiableNavigableMap(users);
 122                 // FIXME do it better
 123                 ((LdifDao) getDirectoryDao()).scope((LdifDao) scopedUserAdmin.getDirectoryDao());
 124                 scopedUserAdmin.init();
 125                 return scopedUserAdmin;
 126         }
 127
 128         @Override
 129         public String getRolePath(Role role) {
 130                 return nameToRelativePath(LdapNameUtils.toLdapName(role.getName()));
 131         }
 132
 133         @Override
 134         public String getRoleSimpleName(Role role) {
 135                 LdapName dn = LdapNameUtils.toLdapName(role.getName());
 136                 String name = LdapNameUtils.getLastRdnValue(dn);
 137                 return name;
 138         }
 139
 140         @Override
 141         public Role getRoleByPath(String path) {
 142                 LdapEntry entry = doGetRole(pathToName(path));
 143                 if (!(entry instanceof Role)) {
 144                         throw new IllegalStateException("Path must be a UserAdmin Role.");
 145                 } else {
 146                         return (Role) entry;
 147                 }
 148         }
 149
 150         protected List<Role> getAllRoles(DirectoryUser user) {
 151                 List<Role> allRoles = new ArrayList<Role>();
 152                 if (user != null) {
 153                         collectRoles((LdapEntry) user, allRoles);
 154                         allRoles.add(user);
 155                 } else
 156                         collectAnonymousRoles(allRoles);
 157                 return allRoles;
 158         }
 159
 160         private void collectRoles(LdapEntry user, List<Role> allRoles) {
 161                 List<LdapEntry> allEntries = new ArrayList<>();
 162                 LdapEntry entry = user;
 163                 collectGroups(entry, allEntries);
 164                 for (LdapEntry e : allEntries) {
 165                         if (e instanceof Role)
 166                                 allRoles.add((Role) e);
 167                 }
 168 //              Attributes attrs = user.getAttributes();
 169 //              // TODO centralize attribute name
 170 //              Attribute memberOf = attrs.get(LdapAttrs.memberOf.name());
 171 //              // if user belongs to this directory, we only check memberOf
 172 //              if (memberOf != null && user.getDn().startsWith(getBaseDn())) {
 173 //                      try {
 174 //                              NamingEnumeration<?> values = memberOf.getAll();
 175 //                              while (values.hasMore()) {
 176 //                                      Object value = values.next();
 177 //                                      LdapName groupDn = new LdapName(value.toString());
 178 //                                      DirectoryUser group = doGetRole(groupDn);
 179 //                                      if (group != null)
 180 //                                              allRoles.add(group);
 181 //                              }
 182 //                      } catch (NamingException e) {
 183 //                              throw new IllegalStateException("Cannot get memberOf groups for " + user, e);
 184 //                      }
 185 //              } else {
 186 //                      for (LdapName groupDn : getDirectoryDao().getDirectGroups(user.getDn())) {
 187 //                              // TODO check for loops
 188 //                              DirectoryUser group = doGetRole(groupDn);
 189 //                              if (group != null) {
 190 //                                      allRoles.add(group);
 191 //                                      collectRoles(group, allRoles);
 192 //                              }
 193 //                      }
 194 //              }
 195         }
 196
 197         private void collectAnonymousRoles(List<Role> allRoles) {
 198                 // TODO gather anonymous roles
 199         }
 200
 201         // USER ADMIN
 202         @Override
 203         public Role getRole(String name) {
 204                 return (Role) doGetRole(toLdapName(name));
 205         }
 206
 207         @Override
 208         public Role[] getRoles(String filter) throws InvalidSyntaxException {
 209                 List<? extends Role> res = getRoles(getBaseDn(), filter, true);
 210                 return res.toArray(new Role[res.size()]);
 211         }
 212
 213         List<DirectoryUser> getRoles(LdapName searchBase, String filter, boolean deep) throws InvalidSyntaxException {
 214                 LdapEntryWorkingCopy wc = getWorkingCopy();
 215 //              Filter f = filter != null ? FrameworkUtil.createFilter(filter) : null;
 216                 List<LdapEntry> searchRes = getDirectoryDao().doGetEntries(searchBase, filter, deep);
 217                 List<DirectoryUser> res = new ArrayList<>();
 218                 for (LdapEntry entry : searchRes)
 219                         res.add((DirectoryUser) entry);
 220                 if (wc != null) {
 221                         for (Iterator<DirectoryUser> it = res.iterator(); it.hasNext();) {
 222                                 DirectoryUser user = (DirectoryUser) it.next();
 223                                 LdapName dn = LdapNameUtils.toLdapName(user.getName());
 224                                 if (wc.getDeletedData().containsKey(dn))
 225                                         it.remove();
 226                         }
 227                         Filter f = filter != null ? FrameworkUtil.createFilter(filter) : null;
 228                         for (LdapEntry ldapEntry : wc.getNewData().values()) {
 229                                 DirectoryUser user = (DirectoryUser) ldapEntry;
 230                                 if (f == null || f.match(user.getProperties()))
 231                                         res.add(user);
 232                         }
 233                         // no need to check modified users,
 234                         // since doGetRoles was already based on the modified attributes
 235                 }
 236
 237                 // if non deep we also search users and groups
 238 //              if (!deep) {
 239 //                      try {
 240 //                              if (!(searchBase.endsWith(new LdapName(getUserBase()))
 241 //                                              || searchBase.endsWith(new LdapName(getGroupBase())))) {
 242 //                                      LdapName usersBase = (LdapName) ((LdapName) searchBase.clone()).add(getUserBase());
 243 //                                      res.addAll(getRoles(usersBase, filter, false));
 244 //                                      LdapName groupsBase = (LdapName) ((LdapName) searchBase.clone()).add(getGroupBase());
 245 //                                      res.addAll(getRoles(groupsBase, filter, false));
 246 //                              }
 247 //                      } catch (InvalidNameException e) {
 248 //                              throw new IllegalStateException("Cannot search users and groups", e);
 249 //                      }
 250 //              }
 251                 return res;
 252         }
 253
 254         @Override
 255         public User getUser(String key, String value) {
 256                 // TODO check value null or empty
 257                 List<DirectoryUser> collectedUsers = new ArrayList<DirectoryUser>();
 258                 if (key != null) {
 259                         doGetUser(key, value, collectedUsers);
 260                 } else {
 261                         throw new IllegalArgumentException("Key cannot be null");
 262                 }
 263
 264                 if (collectedUsers.size() == 1) {
 265                         return collectedUsers.get(0);
 266                 } else if (collectedUsers.size() > 1) {
 267                         // log.warn(collectedUsers.size() + " users for " + (key != null ? key + "=" :
 268                         // "") + value);
 269                 }
 270                 return null;
 271         }
 272
 273         protected void doGetUser(String key, String value, List<DirectoryUser> collectedUsers) {
 274                 String f = "(" + key + "=" + value + ")";
 275                 List<LdapEntry> users = getDirectoryDao().doGetEntries(getBaseDn(), f, true);
 276                 for (LdapEntry entry : users)
 277                         collectedUsers.add((DirectoryUser) entry);
 278         }
 279
 280         @Override
 281         public Authorization getAuthorization(User user) {
 282                 if (user == null) {// anonymous
 283                         return new LdifAuthorization(user, getAllRoles(null));
 284                 }
 285                 LdapName userName = toLdapName(user.getName());
 286                 if (isExternal(userName) && user instanceof LdapEntry) {
 287                         List<Role> allRoles = new ArrayList<Role>();
 288                         collectRoles((LdapEntry) user, allRoles);
 289                         return new LdifAuthorization(user, allRoles);
 290                 } else {
 291
 292                         Subject currentSubject = CurrentSubject.current();
 293                         if (currentSubject != null //
 294                                         && getRealm().isPresent() //
 295                                         && !currentSubject.getPrivateCredentials(Authorization.class).isEmpty() //
 296                                         && !currentSubject.getPrivateCredentials(KerberosTicket.class).isEmpty()) //
 297                         {
 298                                 // TODO not only Kerberos but also bind scope with kept password ?
 299                                 Authorization auth = currentSubject.getPrivateCredentials(Authorization.class).iterator().next();
 300                                 // bind with authenticating user
 301                                 DirectoryUserAdmin scopedUserAdmin = Subject.doAs(currentSubject,
 302                                                 (PrivilegedAction<DirectoryUserAdmin>) () -> (DirectoryUserAdmin) scope(
 303                                                                 new AuthenticatingUser(auth.getName(), new Hashtable<>())));
 304                                 return getAuthorizationFromScoped(scopedUserAdmin, user);
 305                         }
 306
 307                         if (user instanceof DirectoryUser) {
 308                                 return new LdifAuthorization(user, getAllRoles((DirectoryUser) user));
 309                         } else {
 310                                 // bind with authenticating user
 311                                 DirectoryUserAdmin scopedUserAdmin = (DirectoryUserAdmin) scope(user);
 312                                 return getAuthorizationFromScoped(scopedUserAdmin, user);
 313                         }
 314                 }
 315         }
 316
 317         private Authorization getAuthorizationFromScoped(DirectoryUserAdmin scopedUserAdmin, User user) {
 318                 try {
 319                         DirectoryUser directoryUser = (DirectoryUser) scopedUserAdmin.getRole(user.getName());
 320                         if (directoryUser == null)
 321                                 throw new IllegalStateException("No scoped user found for " + user);
 322                         LdifAuthorization authorization = new LdifAuthorization(directoryUser,
 323                                         scopedUserAdmin.getAllRoles(directoryUser));
 324                         return authorization;
 325                 } finally {
 326                         scopedUserAdmin.destroy();
 327                 }
 328         }
 329
 330         @Override
 331         public Role createRole(String name, int type) {
 332                 checkEdit();
 333                 LdapEntryWorkingCopy wc = getWorkingCopy();
 334                 LdapName dn = toLdapName(name);
 335                 if ((getDirectoryDao().entryExists(dn) && !wc.getDeletedData().containsKey(dn))
 336                                 || wc.getNewData().containsKey(dn))
 337                         throw new IllegalArgumentException("Already a role " + name);
 338                 BasicAttributes attrs = new BasicAttributes(true);
 339                 // attrs.put(LdifName.dn.name(), dn.toString());
 340                 Rdn nameRdn = dn.getRdn(dn.size() - 1);
 341                 // TODO deal with multiple attr RDN
 342                 attrs.put(nameRdn.getType(), nameRdn.getValue());
 343                 if (wc.getDeletedData().containsKey(dn)) {
 344                         wc.getDeletedData().remove(dn);
 345                         wc.getModifiedData().put(dn, attrs);
 346                         return getRole(name);
 347                 } else {
 348                         wc.getModifiedData().put(dn, attrs);
 349                         LdapEntry newRole = doCreateRole(dn, type, attrs);
 350                         wc.getNewData().put(dn, newRole);
 351                         return (Role) newRole;
 352                 }
 353         }
 354
 355         private LdapEntry doCreateRole(LdapName dn, int type, Attributes attrs) {
 356                 LdapEntry newRole;
 357                 BasicAttribute objClass = new BasicAttribute(objectClass.name());
 358                 if (type == Role.USER) {
 359                         String userObjClass = getUserObjectClass();
 360                         objClass.add(userObjClass);
 361                         if (inetOrgPerson.name().equals(userObjClass)) {
 362                                 objClass.add(organizationalPerson.name());
 363                                 objClass.add(person.name());
 364                         } else if (organizationalPerson.name().equals(userObjClass)) {
 365                                 objClass.add(person.name());
 366                         }
 367                         objClass.add(top.name());
 368                         objClass.add(extensibleObject.name());
 369                         attrs.put(objClass);
 370                         newRole = newUser(dn);
 371                 } else if (type == Role.GROUP) {
 372                         String groupObjClass = getGroupObjectClass();
 373                         objClass.add(groupObjClass);
 374                         // objClass.add(LdifName.extensibleObject.name());
 375                         objClass.add(top.name());
 376                         attrs.put(objClass);
 377                         newRole = newGroup(dn);
 378                 } else
 379                         throw new IllegalArgumentException("Unsupported type " + type);
 380                 return newRole;
 381         }
 382
 383         @Override
 384         public boolean removeRole(String name) {
 385                 return removeEntry(LdapNameUtils.toLdapName(name));
 386 //              checkEdit();
 387 //              LdapEntryWorkingCopy wc = getWorkingCopy();
 388 //              LdapName dn = toLdapName(name);
 389 //              boolean actuallyDeleted;
 390 //              if (getDirectoryDao().daoHasEntry(dn) || wc.getNewData().containsKey(dn)) {
 391 //                      DirectoryUser user = (DirectoryUser) getRole(name);
 392 //                      wc.getDeletedData().put(dn, user);
 393 //                      actuallyDeleted = true;
 394 //              } else {// just removing from groups (e.g. system roles)
 395 //                      actuallyDeleted = false;
 396 //              }
 397 //              for (LdapName groupDn : getDirectoryDao().getDirectGroups(dn)) {
 398 //                      LdapEntry group = doGetRole(groupDn);
 399 //                      group.getAttributes().get(getMemberAttributeId()).remove(dn.toString());
 400 //              }
 401 //              return actuallyDeleted;
 402         }
 403
 404         /*
 405          * HIERARCHY
 406          */
 407         @Override
 408         public HierarchyUnit getHierarchyUnit(Role role) {
 409                 LdapName dn = LdapNameUtils.toLdapName(role.getName());
 410                 LdapName huDn = LdapNameUtils.getParent(dn);
 411                 HierarchyUnit hierarchyUnit = getDirectoryDao().doGetHierarchyUnit(huDn);
 412                 if (hierarchyUnit == null)
 413                         throw new IllegalStateException("No hierarchy unit found for " + role);
 414                 return hierarchyUnit;
 415         }
 416
 417         @Override
 418         public Iterable<? extends Role> getHierarchyUnitRoles(HierarchyUnit hierarchyUnit, String filter, boolean deep) {
 419                 LdapName dn = LdapNameUtils.toLdapName(hierarchyUnit.getBase());
 420                 try {
 421                         return getRoles(dn, filter, deep);
 422                 } catch (InvalidSyntaxException e) {
 423                         throw new IllegalArgumentException("Cannot filter " + filter + " " + dn, e);
 424                 }
 425         }
 426
 427         /*
 428          * ROLES CREATION
 429          */
 430         protected LdapEntry newUser(LdapName name) {
 431                 // TODO support devices, applications, etc.
 432                 return new LdifUser(this, name);
 433         }
 434
 435         protected LdapEntry newGroup(LdapName name) {
 436                 return new LdifGroup(this, name);
 437
 438         }
 439
 440         // GETTERS
 441         protected UserAdmin getExternalRoles() {
 442                 return externalRoles;
 443         }
 444
 445         public void setExternalRoles(UserAdmin externalRoles) {
 446                 this.externalRoles = externalRoles;
 447         }
 448
 449 //      public void setTransactionManager(TransactionManager transactionManager) {
 450 //              this.transactionManager = transactionManager;
 451 //      }
 452
 453         /*
 454          * STATIC UTILITIES
 455          */
 456         static LdapName toLdapName(String name) {
 457                 try {
 458                         return new LdapName(name);
 459                 } catch (InvalidNameException e) {
 460                         throw new IllegalArgumentException(name + " is not an LDAP name", e);
 461                 }
 462         }
 463 }